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A. Policy Statement 


OANDA Asia Pacific Pte. Ltd. (“OANDA”, “we” and “us”) and our affiliates are fully committed to 
safekeeping your privacy online and we take our responsibility to protect the information you provide us 
very seriously. The success of our business builds upon our ability to maintain the trust of our clients. The 
purpose of OANDA’s Privacy Policy is to provide a summary of the type of personal data that we collect 
from our customers (“Personal Information”) and how such information is collected, used, transferred, 
disclosed and maintained. The policy does not cover any external third party websites that may be 
accessed through links provided on our website. We will be the data controller of such Personal 
Information and will process your Personal Information in accordance with our Privacy Policy. 


The use and/or purchase of any of our services is subject to the applicable terms, the use of our website is 
subject to our website terms of use and this Privacy Policy is incorporated into and forms part of those 
terms. 
B. Personal Information OANDA Collects 
OANDA collects Personal Information about our customers from the following two main channels: 
1. Website, Account and General Communications 
In order to provide materials and services to you, when you visit our website, request materials from 
us, register for events, or contract with us, we will collect data from you. We will receive your 
information in these circumstances, as examples: 
e Visiting and using our website 
e Account Application Forms and other documents and data submitted by customers, such as 
customer name, residential address, government issued ID numbers (such as social security 
numbers), date of birth, email address, employment information, education, investment 
experience, annual income, and estimated net worth 
e Customer Transactions with OANDA such as ordering our products/services, account deposits and 
withdrawals that require customers to provide bank account and/or credit card related 


information 


e Communications with OANDA including with customer service representatives and our LiveChat 
function. 


We refer collectively to these interactions as “Website Services”. We explain below how we collect 
and use your information collected through the Website Services. 


2. Platform 


If you request access to our FX trading platform and payment portal (the “Platform”), we will also collect 
information about your use of the Platform. The information collected through the Platform will include 


usage, performance, analytic and metadata and some of this may include your Personal Information. 
This does not include the OANDA demo trading account (which falls within the scope of our Website 
Services). 


We wish to assure you that OANDA does not collect more Personal Information than is required to open 
and operate customers’ accounts, and to comply with regulatory compliance and other legal obligations. 
Apart from Personal Information, we may collect other types of information which is not linked to an 
individual and is anonymous. For example, traffic pattern information relating to our website or services 
provided by OANDA and/or third parties we may work with. We may ask for other data voluntarily from 
time to time (for example, through market research, surveys or promotions) to enable us to improve our 
service or study the wider needs of our customers or potential customers. 


Website, Account and General Communications 
What We Collect 


We (or third-parties acting on our behalf) may collect your information, including your Personal 
Information, when providing the Website Services including: 


e Name 
e Email 
e Address 


e Phone Number 

e Country of Residence 
e Date of Birth/Age 

e |P address. 


Platform 
What We Collect 


We (or third-parties acting on our behalf) may collect your information, including your Personal 
Information, when providing access to the Platform including: 


e Name 
e Email 
e Address 


e Phone Number 

e Country of Residence 

e Date of Birth/Age 

e Tax Identification Number 

e Income 

e Income Source 

e Level of liquid savings and investment 
e IP address 

e Employment Status 

e Employer Name 

e Industry 

e Trading Experience 

e Offences by way of a background check 
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e Government Identifiers: Social Security Number/Passport Number & Passport Expiry (which we 
electronically verify). 


C. How OANDA Uses Personal Information 
We may hold and retain information about you for various purposes based on different reasons. 
1. Website, Account and General Communications 


Some of the information we collect from you we need to enable us to deliver the Website Services to 
you in accordance with our terms, sometimes we are required by law and regulations to collect and 
process this information about you. At other times, we consider it is in our legitimate business interests 
to collect and process this information, taking into consideration your privacy rights. We may use your 
information to: 


e Fulfil your orders or respond to requests you make in connection with providing the services under 
our terms with you 


To provide you with a response pursuant to your request and your agreement with the applicable 
terms, we will collect and use Personal Information including your name and email address. 


e Provide our Website Services to you, including access to a demo account or support through our 
LiveChat function. 


In order to perform the Website Services under the contract between you and OANDA, we have 
to collect certain Information from you such as your name and contact details. Without this 
information, we may not be able to deliver the services which you request from us. 


e Improve and develop the Website Services 


We look for ways to innovate and advance our Website Services. We will use Information about 
how you use the Website Services, including how you interact with various aspects of the Website 
Services, the duration for which you use the Website Services and content that is of interest to 
you, in order to do this. It is in our legitimate business interests to use Personal Information in this 
way to develop improved Website Services. 


e Send administrative information, changes to contract terms or policies 


Where we make updates to terms and policies we are required under certain laws and under our 
contract with you, to notify you of these changes. Other administrative communications, may be 
necessary in order for us to perform our obligations under the contract with you, or may be sent 
out in line with our legitimate business interests. 


e Send marketing communications like product announcements, educational materials or upcoming 
online or offline events, where you have not objected to receiving these or with your consent 
where required. This may also include inviting you to participate in various promotional activities 


It is in our legitimate business interests to generate growth for our own business to ensure we 


continue to generate development for our company and drive sales of our products and services. 
We will carry out marketing campaigns in accordance with other applicable laws. 
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e Research and analyse how our Website Services are used via cookies, web beacons and other 
similar technologies to personalise the Website Services. (For more information about our use of 
cookies and your choices to opt-out of their use, see “Cookies” at section L below.) 


We use your information in our legitimate business to understand how you interact with our 
Website Services and to deliver relevant content to you online. 


e Diagnose and fix technical issues and monitor the security of our environments 


We need to understand how our Website Services are performing in order to prevent and address 
any issues that may present themselves with regard to technical and security operations. We may 
process your Personal Information for this purpose in our legitimate business interests to protect 
the integrity of the Website Services 


e To comply with any applicable law, regulation, legal process, or governmental request. 
e For any other purpose disclosed to you in connection with our Website Services from time to time 


If we intend to process your Personal Information for a purpose other than that set out above, we 
will provide you with information prior to such processing. 


It is also in our legitimate business interests to process your Personal Information to protect our rights 
or property, or the security or integrity of our Website Services. 


Third-Party Content. The Website Services may offer access to third party services. These services may 
collect and use your information. This Privacy Policy does not extend to third-party apps or add-ons 
(which may also collect your Information) even if packaged by OANDA or offered through the Website 
Services. 


2. Platform 


We collect Personal Information including payment details, as set out above, in order to provide access 
to the Platform under the contract between OANDA and you. We are also required to keep these 
payment details to comply with our own legal obligations. 


We also collect and process usage data when you use our Platform (e.g. IP address, session duration, 
activities undertaken on the Platform and other use data) (“Usage Data”) in order to provide, maintain, 
and improve our Platform. 


In addition, we collect and process data about our Platform, features or users in order to improve the 
Platform (“Analytics Data”). Analytics Data may include information about the devices operating the 
Platform (e.g. browser type/version, OS type/version, device type/version), or such other similar 
information about user configuration or operation of service features or functionality. 


Whilst both Usage Data and Analytics Data may not contain information that we can use to identify you 


in the "real world" (such as a name or address), we collect this data and store it against a uniquely 
assigned ID. 
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We use automated decision making to analyse the transactions you conduct using the Platform and 
create a profile for your usage. We use algorithms to perform this analysis. This allows us to monitor 
the transactions for fraudulent activity as well as review general performance of our clients. If this raises 
concerns about fraudulent activity, we may take steps to close the client account and liaise with 
regulators as is necessary. 


How we use this Platform data 
Usage Data. Specifically, OANDA may use Usage Data to: 
e = Positively identify and determine eligibility of customers opening accounts 
e Evaluate whether currency trading is suitable for each customer 
e Complete bank deposits and withdrawals 
e = Effect, administer or enforce transactions requested or authorised by the customer and 
e Maintain or service the customer’s account with OANDA. 


Our lawful basis for using Usage Data is in order to take steps to enter into a contract with you or as is 
necessary for the performance of a contract already in place between us. 


Analytics Data. OANDA uses Analytics Data to help us better understand how our Platform is being 
used, make improvements, and develop new features, products and services. We may use this data to: 


e Better understand how our users configure and use our Platform 
e Determine which configurations or practices optimise performance (e.g. best practices) 
e Perform data analysis and audits 


e identify, understand and anticipate performance issues and the environmental factors that affect 
them 


e Other such business purposes relating to the operation, improvement, or development of our 
Platform. 


The use of this Analytics Data, for the purposes described in the above, is carried out pursuant to our 
legitimate business interests, to develop, expand and improve our Platform offering. 


We are sure to balance our legitimate business interests with your privacy rights and we take steps in 
how we process and use Usage Data and Analytics Data to protect these. 


Personal Information collected online may be combined with other information customers provide to 
OANDA in hard copy or through the OANDA help desk. 


D. Disclosure of Customer Personal Information 


OANDA may disclose Personal Information of current and former customers to affiliated and non-affiliated 
third party entities in connection with our business, including, without limitation: 
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e to OANDA’s service providers that perform services on OANDA’s behalf under written agreements 
which restrict use of Personal Information to the limited purposes for which it is provided to them 
and to refrain from further use or disclosure except as permitted by law. This may include 
companies who perform background checks or identity verification, infrastructure, data analysis, 
business intelligence, customer relationship platform providers, marketing support services 
providers, cloud service providers, and IT service providers 


e tocommunicate with credit reference and information agencies 


e to OANDA strategic partners to permit them to assess your interest in Website Services, including 
foreign exchange payments and international money transfers 


e to OANDA affiliates, who are permitted to disclose and use the information only to the extent that 
OANDA may disclose and use the information under this Privacy Policy 


e inthe ordinary course of business to OANDA’s attorneys, accountants and auditors 

e to persons holding a legal or beneficial interest relating to the customer’s account 

e to persons acting in a fiduciary, representative, or attorney capacity in relation to an account 
e to protect against actual or potential fraud, unauthorised transactions, claims or other liability 


e to government, regulatory or law enforcement agencies to the extent permitted or required by 
law, or to comply with applicable legal requirements 


e to monitor our services, whether provided by ourselves or a third party 


e to comply with civil, criminal or regulatory investigations, or judicial process, summons or warrant 
by relevant authorities or 


e in the event of a proposed or actual reorganisation, merger, sale, joint venture, assignment, 
transfer, or other disposition of all or any portion of OANDA’s business, assets or stock (including 
in connection with any bankruptcy or similar proceedings). 


The client confidentiality obligations set out in our Privacy Policy do not and will not apply to, and in respect 
of, any confidential information required to be disclosed (by us or you) pursuant to any applicable law, or 
the lawful request of any court of competent jurisdiction, government agency, or regulatory body, provided 
in each case you (or we) notify and consult with us (or you) in advance and as to the timing and content of 
such disclosure, except where applicable law prohibits us (or you) from doing so. 


Except as stated in this Privacy Policy, OANDA will not share Personal Information about any present or 
former customer with any non-affiliated third party without the customer’s prior written consent. 

E. How we secure your Personal Information 

All information you provide to us is stored on our secure servers. Where we have given you (or where you 
have chosen) a password which enables you to access certain parts of our Website Services and Platform, 


you are responsible for keeping this password confidential. We ask you not to share a password with 
anyone. 
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Unfortunately, the transmission of information via the Internet is not completely secure. Although we will 
do our best to protect your Personal Information, we cannot guarantee the security of your data 
transmitted to our Website Services and Platform; any transmission is at your own risk. Once we have 
received your information, we will use strict procedures and security features to try to prevent 
unauthorised access. 


F. Transfer of Personal Information Overseas 


In certain circumstances, we may need to transfer your personal information outside of Singapore. Any 
such transfer of your personal information outside of Singapore will be carried out in accordance with the 
Personal Data Protection Act (“PDPA”) requirements. 


You acknowledge and give consent to the transfer of your personal information to any member of our 
group (which means our subsidiaries, our ultimate holding company and its subsidiaries) as well as third 
party service providers and agents (including lawyers / law firms) outside of Singapore for one or more of 
the purposes described in this document. 


You are entitled to request details of such transfer from us at any time. 


G. How long we retain your Personal Information for 


We retain Personal Information (a) in relation to the Platform, for as long as you have an account with us 
in order to meet our contractual obligations to you and for seven years after that to identify any issues and 
resolve any legal proceedings, and (b) in relation to Website Services, for 12 months unless such data is 
likely to relate to a contract you may/have entered into in the future, and subject to any subject access 
requests you may make. We may also retain aggregate information beyond this time for research purposes 
and to help us develop and improve our services. You cannot be identified from aggregate information 
retained or used for these purposes. 


H. Do-Not-Call Registry 


From time to time, OANDA and our partners may contact you via call or SMS to inform you about our latest 
products, services, benefits, promotions and rewards. 


If you have previously consented to receiving such calls and messages, you will continue to be updated on 
our promotions and marketing campaigns. However, if you no longer wish to continue to receive marketing 
calls or messages, you may withdraw your consent by contacting our Client Experience (“CX”) Department 


at +65 6579 8289 or frontdesk@oanda.com. 


For potential customers, we will only contact you via the telephone for marketing and promotional 
messages/calls after ascertaining that you have not registered with the national Do Not Call (DNC) Registry 
administered by the Personal Data Protection Commission of Singapore. However, as we may rely on the 
one-month validity period of our search results, you may inadvertently still receive marketing or 
promotional messages/calls. 


If you had received a telemarketing call from someone representing OANDA although you have registered 
with the DNC Registry or withdrawn your consent, please inform us at frontdesk@oanda.com, or contact 
us by calling +65 6579 8289. 


The above changes will generally not affect informational and service related messages sent by OANDA 
(e.g. messages relating to your account). 
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l. Consent 


Generally, when we request for Personal Information in the course of providing you a service and / or 
product and you provide us with such Personal Information, there is implied consent that you agree to 
provide us with Personal Information in order for us to provide you with the requested service and / or 
product. 


In some circumstances and as required by applicable laws, we will seek your express consent when 
collecting your personal information. For example, where there are new purposes for the use of your 
Personal Information, we will seek your fresh consent. 


If you do not consent to provide the requisite Personal Information that we need at the point of application 
or in the course of maintaining your account(s) with us, we may not be able to open account(s) for you or 
provide the specific service or product that you require. You are entitled to withdraw your consent for the 
collection of Personal Information by contacting us. However, this may affect our ability to maintain your 
account(s) with us. 


J. Situations Not Requiring Consent 


We may share non-personal, non-individual information in aggregate form with third parties for business 
purposes or we may disclose to our business partners the number of customers in certain demographic 
groups or who carried out certain transactions. 


K. Customer Recourse 


Any concerns a customer may have regarding OANDA’s Privacy Policy or specific complaints about how 
customer Personal Information has been collected, used or disclosed should be forwarded in writing to 
OANDA’s Privacy Officer. OANDA will thoroughly investigate the complaint and will take whatever actions 
are warranted and notify the customer once this has been done. 


Under the PDPA, you have the right to obtain a copy of any personal information which we hold about you 
and to advise us of any inaccuracy that requires a correction. In addition, you are entitled to know how 
your personal information has been used or disclosed in the past one year. 


The PDPA does set out some exceptions to this. For instance, where the amount of effort and resources 
needed to provide access would be unreasonable or disproportionate to your interests or if we have 
satisfied ourselves on reasonable grounds that the correction should not be made. 


To make a request, you will need to contact us at privacy@oanda.com and specify what data you require 
correcting. We may charge a reasonable administrative fee for this service to cover the cost of verifying 
the application and locating, retrieving, reviewing and amending any material requested. If the personal 
information sought is extensive, we will advise the likely cost in advance and can help to refine your request 
if required. 


We will acknowledge your request within 30-days and respond promptly to it. In exceptional 


circumstances, we reserve the right to deny you access to your personal information and may provide an 
explanation as required by applicable laws. 
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L. Cookies 


Cookies are small text files placed in visitors’ computer browsers to store their preferences. The Website 
Services, our Platform, and our third party partners, collect and store information that is generated 
automatically as you use it, including your preferences and anonymous usage statistics. 


OANDA collects information about your device and uses tracking mechanisms such as cookies to: (i) 
facilitate customer use of our website and mobile applications, (ii) enable customisation of our online 
services and website features, (iii) avoid customer re-entry of data, (iv) store customer preferences for 
certain kinds of information, (v) enhance security measures, and (vi) gather data about usage of our website 
and mobile applications for research and promotions. 


OANDA uses cookies from third party service providers to facilitate website tracking and security measures 
and may share the information collected with third parties acting as our service providers, who are required 
to maintain the confidentiality of the information. 


We use these cookies and other technologies on the basis that they are necessary for the performance of 
a contract with you, or because using them is in our legitimate interests (where we have considered that 
these are not overridden by your rights), and, in some cases, where required by law, where you have 
consented to their use. 


We use the following types of cookies: 


Essential cookies. These are cookies that are required for the operation of our Website Services 
and/or our Platform and under our terms with you. They include, for example, cookies that enable 
you to log into secure areas of our Website Services and/or our Platform. 


Analytical/performance cookies. They allow us to recognise and count the number of visitors and to 
see how visitors move around our Website Services and/or our Platform when they are using it. This 
helps us for our legitimate interests of improving the way our Website Services and/or our Platform 
works, for example, by ensuring that users are finding what they are looking for easily. 


Behavioural cookies. These are used to recognise you when you return to our Website Services and/or 
our Platform. This enables us, subject to your choices and preferences, to personalise our content, 
greet you by name and remember your preferences (for example, your choice of language or region). 


Marketing cookies. These enable you to experience more relevant online content and see adverts 
which are aligned with your interests, as indicated by your activity on our site. 


Customers can configure their browser preferences not to accept these cookies however this may result in 
reduced functionality. Some third-party vendors that provide ads on OANDA web pages may use cookies 
to collect details on customer website visits and other data (but not names, addresses, email addresses, or 
telephone numbers) in order to provide ads about goods and services of particular interest to individual 
customers. For more information on this practice or to opt out, customers can visit the Network Advertising 
Initiative site. Opt-outs are also available for Google Analytics and TUNE Marketing. 


M. Technology Improvements 
We are constantly striving to improve functionality on our website through technology improvements. This 
may mean a change to the way in which Personal Information is collected or used. The impact of any 


technology changes which may affect your privacy will be notified to you through this Privacy Policy at the 
time of the change. 
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N. Links to non-OANDA websites 


The OANDA website may provide links to third-party websites for customer convenience and 
information. If customers decide to access those links, they will leave the OANDA website. OANDA does 
not control those third-party sites or their privacy practices, which may differ from OANDA’s. OANDA does 
not endorse or make any representations about third-party websites. Any Personal Information customers 
choose to give to unrelated third parties is not covered by OANDA’s Privacy Policy. Customers should 
review the privacy policy of any third-party website before submitting Personal Information. Some third- 
party companies may choose to share their Personal Information with OANDA. That sharing is governed 
by the disclosing company’s privacy policy. 


O. Notification of Policy and Policy Changes 


OANDA provides an initial notice of its Privacy Policy to customers at the time it establishes a customer 
relationship, and the Privacy Policy is posted on its website. Updates will be posted on the OANDA website, 
so our customers will always know what information we collect, how we use it, and what choices they 
have. This privacy policy was last updated on May 25, 2018. 


P. For Customers Who Are Resident in the European Union (EU) 


The data that we process in relation to you may be transferred to, and stored at, a destination outside the 
European Economic Area (EEA) that may not be subject to equivalent data protection law. It may also be 
processed by staff situated outside the EEA who work for us or for one of our suppliers. 


We may transfer your personal information outside the EEA: 
e In order to store it 


e In order to enable us to provide goods or services to and fulfil our contract with you or the 
company you work for. This includes order fulfilment, processing of payment details, and the 
provision of support services 


e Where we are legally required to do so 


e In order to facilitate the operation of our group of businesses, where it is in our legitimate interests 
and we have concluded these are not overridden by your rights. 


Where your information is transferred outside the EEA, we will take all steps reasonably necessary to 
ensure that your data is subject to appropriate safeguards, such as relying on a recognised legal adequacy 
mechanism, and that it is treated securely and in accordance with this Privacy Policy. We may transfer your 
personal information to the following countries outside the EEA: 


e Any member of our group, which means our subsidiaries, our ultimate holding company and its 
subsidiaries, the details of which are set out in the table below, and for these transfers we use 
European Commission approved contractual clauses for transfers (referred to as “Model Clauses”) 


Group Member Location 
OANDA Global Corporation United States 
OANDA Corporation United States 
OANDA (Canada) Corporation ULC Canada 
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OANDA Asia Pacific Pte. Ltd. Singapore 


OANDA Japan Inc. Japan 

OANDA Australia Pty. Ltd. Australia 

OANDA India Pvt. Ltd. India 

OANDA Hong Kong Ltd. China (Hong Kong SAR) 
OANDA Business Consulting (Shanghai) Co., Ltd. China 


e Our vendors, details of which are set out below, and for these purposes we use Model Clauses: 


Vendor Purpose Location 

Email Service Provider United States 

Cloud Data Storage United States 
Messaging Service Provider United States 

Chat Service for Customer Support United States, Europe 
Team Collaboration Software United States, Australia 
Customer Relationship Management United States 

Identity Verification United States, Canada 
Business Intelligence United States 
Marketing Support Services United States 

Funds Processing United States, Canada 


Your Data Subject Rights 
You have the right under certain circumstances: 


e to receive information about the processing of Personal Information concerning you. You are 
entitled to access your Personal Information 


e to request the rectification or erasure of your Personal Information held by us 


e to object to the further processing of your Personal Information, including the right to object to 
marketing 


e to request that your provided Personal Information be moved to a third party. 
Depending on the context of your request, such as erasure, we may not be able to provide you with access 
to some or all of the Website Services and/or Platform, since we process your information in order to 
provide you with such access. 


Your right to withdraw consent: 


Where the processing of your Personal Information by us is based on consent, you have the right to 
withdraw that consent at any time by contacting us as per section R below. 


How to exercise your rights 
You can also exercise the rights listed above at any time by contacting us at privacy@oanda.com 


If your request or concern is not satisfactorily resolved by us, you may approach your local data protection 
authority (to your habitual residence, your place of work, or an alleged infringement of the General Data 
Protection Regulation (GDPR)) (see http://ec.europa.eu/justice/article-29/structure/data-protection- 
authorities/index_en.htm). The local data protection authority can provide further information about your 
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rights and our obligations in relation to your Personal Information, as well as deal with any complaints that 
you have about our processing of your Personal Information. 


Q. Governing Law 


Note that as we are a Singapore registered company, this Privacy Policy has been drafted to be in 
accordance with the laws of Singapore. We do not represent or warrant that this Privacy Policy complies 
with the privacy laws of any other jurisdiction and accordingly, you shall not construe this Privacy Policy as 
such. 


R. Contact Us: 


We will never ask you for security information such as passwords over the phone or by email. If you receive 
a call or email which you are not sure has come from OANDA Asia Pacific Pte. Ltd., please contact us 


at infosec@oanda.com. 


We value our customers’ opinions. If they have comments or questions about our Privacy Policy, they are 
invited to us at privacy@oanda.com or write to us at: Privacy Office, OANDA Asia Pacific Pte. Ltd., 50 
Collyer Quay, #04-03 OUE Bayfront, Singapore 049321. 
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